Messages in a Bottle

Posted by Ritoban Mukherjee

https://lifehacker.com/tech/how-to-use-ai-browsers-without-getting-hacked?utm_medium=RSS

For the past few days, I’ve been poking around every AI browser I could get my hands on. So far, I’ve performed general research tasks on Perplexity Comet and used ChatGPT Atlas to successfully navigate an Amazon checkout. I even spent some time familiarizing myself with the new Dia browser from the developers of Arc.

As I've explored these browsers, I've been mindful of the many security risks to contend with: Prompt injection, where malicious AI prompts are hidden in a website or browser extension’s HTML source code, is the most obvious threat. But there are also cases of AI agents acting without a user’s permission to access your logged-in accounts. Moreover, AI browsers can leak data between browser tabs and hand over user credentials on clever prompting without even using any malicious code. 

But despite the risks, there are legitimate ways to experiment with AI browsers without compromising your privacy. In fact, most of these browsers have optional features you can enable to both beef up your security and keep the apps from having more access than they need. If you're going to use an AI browser on your device, here's what you need to know to protect yourself.

What makes AI browsers a security risk?

A regular web browser can only open a page for you after you make the request. You still decide which sites to navigate to and what buttons to interact with. With AI browsers like Atlas or Comet, the browsers themselves scan and analyze a web page for you, summarize information, and even act autonomously to execute tasks in agent mode. These things make AI browsers very convenient for daily use, but they also expose them to new vulnerabilities, as attackers can now manipulate the browser to access your accounts and data much more easily. 

AI prompt injection is the most popular example, since bad actors simply need to hide malicious instructions within websites for it to work. Even the official OpenAI documentation warns against using Atlas with production data because of prompt injection fears. Worse still, prompt injection attacks require no compromising action on your part. Simply navigating to a web page that has these AI prompts hidden in layers of source code is all it takes. You won’t even see the malicious instructions while you’re browsing the web page, but your browser will read the invisible instructions and automatically do what it tells them without asking for verification or consent from you.

Brave’s security team used several prompt injection attacks to demonstrate issues with Perplexity Comet, which has since been termed CometJacking. In one particular case, Comet dug up its user's email address, obtained a one-time password from their inbox, and forwarded it to an attacker without anyone the wiser. All it took was a request to summarize a Reddit thread that had malicious prompts hidden in it. 

ChatGPT Atlas has also revealed similar vulnerabilities. Security researcher Johann Rehberger got the browser to switch from light mode to dark mode using a simple command hidden inside a Word document that he asked the browser to read. As LayerX explains, Atlas is also susceptible to cross-site request forgery (CSRF), where a malicious web page can send instructions to your browser as if you had typed them yourself. Moreover, AI browsers don’t use the same blocklists and heuristics as traditional ones to flag known phishing websites, so they’re more likely to let you access a scammer’s website without blocking it. LayerX says Atlas users are 90% more susceptible to these types of attacks compared to Chrome or Edge users. 

Automated checkouts carry a direct financial risk. While AI browsers are relatively new, Amazon already won a court injunction to prevent Comet from completing checkouts for users on its websites, because it’s known to bypass certain security measures put in place to prevent financial fraud.

Enable built-in browser settings for better safety

AI browsers carry too many vulnerabilities and loopholes for regular usage, but that doesn’t mean you can’t use them at all without compromising your data. There are many built-in privacy settings you can enable for extra protection, along with some general best practices for safe browsing that can be particularly useful. Before you start using an AI browser, make sure that it’s configured correctly to get rid of the biggest loopholes that attackers tend to use. Here’s what I discovered to be most effective. 

Disable data sharing so AI browsers don’t train models on your data

Almost every AI browser uses your browsing patterns and search history to train future iterations of its AI models, so it’s effectively getting better at doing things by learning from your day-to-day tasks. That means all your browsing data is being sent to the browser’s developers by default unless you specifically opt out. Luckily, browsers that train models on your data also give you the option to disable training, at least on paid plans. This is always the first feature you should turn off if you use AI Browsers.

• ChatGPT Atlas: Navigate to Settings > Data Controls and disable Improve model for everyone to disable model training. You can also selectively opt out of letting ChatGPT use your browsing history or audio recordings of chat sessions for model training here. 

• Perplexity Comet: Go to New Tab Page > Account > Preferences. Toggle off AI data retention to opt out of model training from Perplexity. 

• Dia: From your browser window, visit Settings > Privacy. Disable the option that says Share content data to improve Dia.

Keep your browser from accessing your logged-in sessions

Using the Logged out version of Agent mode with ChatGPT Atlas Credit: OpenAI/ChatGPT

As we saw with the Comet demonstration, AI browsers can be manipulated into accessing your logged-in accounts on different websites and retrieving sensitive information through prompt injection. Depending on their level of access, they can also go into your accounts to execute certain actions without your knowledge, like sending an email or downloading a file. 

In ChatGPT Atlas, you can specifically prevent the AI from accessing your logged-in browser sessions in Agent Mode, so that it’s forced to ask for your credentials each time it needs to log into an email account or social media profile. While there’s no exact equivalent to this feature with Comet or Dia, those browsers also offer controls that let you decide how much access your agent can have. 

• ChatGPT Atlas: When you start a new chat inside ChatGPT Atlas, choose Agent mode from the + menu. Right next to the + menu, you’ll now see a dropdown that lets you switch between Logged in and Logged out to control whether the AI agent has access to your logged-in browser cookies. If you choose to stay logged out, Atlas won’t be able to access your active sessions by default, instead prompting you to log in manually if your task requires access to a user account. 

• Perplexity Comet: In Comet, there’s no universal toggle that restricts access to logged-in sessions. Perplexity notes that Comet does not have access to your passwords since those are only stored in your operating system’s vault, but it can still use your active sessions to pull sensitive information from logged-in accounts or execute tasks using those accounts. So, your best bet is to use Incognito mode when logging into any websites with the Comet browser, so you don’t stay logged in after you quit. 

• Dia: Like Atlas and Comet, Dia is also vulnerable to CSRF, prompt injection, and memory poisoning attacks that allow hackers to hijack your logged-in account sessions. Like Comet, Dia does not have a dedicated Logged out mode, and the AI is designed to access all your logged-in sessions by default to automate web-based tasks. Once again, you should use the browser’s incognito mode whenever you log into an account. You can also navigate to Privacy and security > Delete browsing data from dia://settings/ to delete your existing session cookies and log out of all active accounts. 

Turn off persistent memory unless you really need it

With standard prompt injection attacks, AI browsers read an attacker’s instructions and execute them only a single time. But there’s a more sophisticated form of prompt injection called memory poisoning. Attackers inject malicious instructions into your AI’s account-specific memory, which is retained across all your devices in each and every session. For example, an attacker could use memory poisoning to have your browser leak your most recent emails each day, instead of just the one time it reads malicious instructions. Hackers can use this tactic to compromise your data and hijack access across multiple devices where you use the same AI browser, which is even more of a threat with cross-platform browsers like Comet and Dia. 

• ChatGPT Atlas: Go to Settings > Personalization. Toggle off Reference browser memories to prevent ChatGPT from retaining any memory from your previous chat sessions. This will effectively prevent it from getting better at your tasks by learning from your data, but it will also shield you from attacks that specifically target this feature. OpenAI notes that ChatGPT Atlas has built-in security filters that restrict access to sensitive information like government ID, bank account or credit card numbers, and SSNs. But disabling browser memories entirely offers much better safety. If that feels too extreme, you can also use incognito mode when performing any tasks that you’d rather not have relegated to your browser memory, or go to Settings > Personalization > View browser memories to delete or archive memories you don’t want retained. 

• Perplexity Comet: You can go to comet://settings/ > Privacy and security > Delete browsing data to clear your browsing history, cache, and cookies. To delete saved AI memories from your Perplexity account, you can navigate to New Tab Page > Account > Preferences > Memory, where you can choose to disable memory retention by toggling off Use search history and Notes. You can also click Manage memories to alter or delete specific memories. 

• Dia: If you click on the Personalization button in a new tab, Dia will take you to a page where you can adjust how memory gets used. Toggle off Personalize new chats so Dia can’t draw from its preexisting memory when you start new conversations. If you want to clear or disable memory retention altogether, you can go to Settings > Memory, then click Reset Memory or Disable Memory. 

Restrict what agents can access on sensitive sites

Restrict access to sensitive sites when using Comet Credit: Perplexity AI

With Atlas, hardcoded limits prevent the browser from running code, downloading files, installing extensions, or accessing your device’s file system by default. With Comet and Dia, things are kept more open-ended, though they both offer some protection from letting your agents handle sensitive financial data by default. But if you’d like to take this a step further, you can disable agent access to sensitive websites like banking and healthcare platforms, so that they can’t see anything or take actions on these sites. Doing this fully insulates you from prompt injection attacks aimed at these platforms. 

• ChatGPT Atlas: Go to Settings > Personalization. You’ll see an option called ChatGPT page visibility. If you click on it, you can add a list of websites where your agents won’t be able to access any data or take actions even when prompted. But you’ll still be able to access these sites using the browser manually. 

• Perplexity Comet: You can adjust Comet’s permissions on a more granular level to prevent it from performing specific tasks on certain websites. Go to Settings > Privacy and security, then take a look at the options under Comet Assistant to find Block personal search for these websites. This should give you more options to configure which websites Comet can navigate to and interact with, as well as whether it can access your browser history by default. 

• Dia: You can visit dia://settings/ > Privacy and security > Site settings to control all site permissions on an individual level. However, this does not prevent agents from seeing the data on these websites. To prevent Dia from gaining access to data from sensitive sites, it’s better to just avoid logging into any private accounts unless in incognito mode. 

A few additional best practices for AI browser safety

Generally speaking, the less data and permissions that your agentic browser has access to, the less damage it can do during an attack. Apart from the built-in security settings described above, there are some general best practices that I like to follow whenever using a browser like Atlas, Comet, or Dia:

• Keep using your regular browser, like Chrome or Firefox, for most day-to-day work. Maintain a separate profile for AI browsers with no sensitive logins just for running AI browsing tasks.

• Don’t download AI browsers or AI browser extensions from unofficial sources or third-party marketplaces. Hackers are floating a lot of fake and malicious software in this space, so keep to the official sources to reduce exposure. 

• Avoid accessing user-generated content platforms like Reddit with your AI browser, which are a haven for prompt injection attacks. But if you must do it, make sure to restrict your agents from seeing or accessing anything on these sites. 

• Don’t copy-paste long strings of text or URLs into your AI browser without verifying them first. Attackers can bury prompt injection attempts in longer URL strings. This is a very common exploit from hackers targeting Atlas’ Omnibox, the browser's search and prompt bar combo.

• When asking an agent to execute multi-step workflows, always keep an eye on what it’s doing and use the pause or interrupt controls to stop any suspicious activity as soon as you spot it. 

• For sensitive platforms like financial websites or workplace communication apps, enable two-factor authentication on your account to prevent agents from logging in without your knowledge. 

https://lifehacker.com/tech/how-to-use-ai-browsers-without-getting-hacked?utm_medium=RSS

Posted by Beth Skwarecki

https://lifehacker.com/health/should-you-still-work-out-if-sleep-deprived?utm_medium=RSS

We may earn a commission from links on this page.

Should you work out if you haven't gotten enough sleep? While you're always allowed to take a guilt-free rest day if you feel you need it, I often see people talking themselves out of a perfectly good workout because they think it will somehow be a waste of time. Fortunately, we have some science to answer the question.

In that study, people who habitually got five (only five!) hours of sleep were able to make good gains while strength training with resistance bands. I’ll dig into the study a bit more below, but first, let’s cover the basics of how sleep relates to muscle growth and strength building.

How much sleep do you need for muscle growth? 

A healthy lifestyle should include a healthy amount of sleep, which will be somewhere between seven and nine hours, depending on the person. If you exercise a lot, that may add to your sleep need; it’s not unusual for athletes to sleep nine hours or more. 

When it comes to muscle growth specifically, there’s no definitive number of hours needed. Exercise science researcher Brad Schoenfeld, who posted about the study of five-hour sleepers on Instagram in 2024, mentioned in the caption that there probably is a minimum amount of sleep we need for gains, but “exactly how much isn’t clear and likely would be specific to the individual.” 

In other words, science can’t answer this for you quite yet, but you probably can’t get by on way too little sleep. Seven hours is probably fine. What about five? That’s what the study looked at. 

Can I still build muscle on five hours of sleep a night? 

Yes, most likely! The study is, of course, not the be-all-end-all answer to the question (no study ever is), but it gives strong evidence pointing toward five hours a night being probably fine. You can read the full text of the 2024 study here. The participants were men who did not usually do any strength training, and they were excluded from the study if they had any diagnosed sleep disorders. The 36 men were divided into three groups: a group that averaged seven hours of sleep per night, a group that averaged five-ish hours a night, and a control group that averaged more than seven hours a night. 

The control group did not exercise in the study. The seven-hour and five-hour groups did. (Perhaps we can think of the control group as the “what if I slept in instead of hitting the gym?” group.)

The results? For some muscle groups, the seven-hour group got slightly better gains than the five-hour group, but for others. they were roughly even. Both groups gained more muscle than the non-exercising control group. The authors write: “The results of the present study suggest that the value of 7 hours as a minimum night sleeping time can be relaxed when it comes to a recuperative state related to muscle strength performance.”

The study has its limitations, including the fact that it was all men, that they used resistance bands instead of barbells or dumbbells, and that the subjects were untrained to start with (making it easier for them to grow muscle). But the results match up with what pretty much any trainer or fitness enthusiast could tell you: A full night’s sleep is great to have, but not essential to making progress in the gym.

Consistency matters more than getting the details right

How can this be, if rest is important to muscle growth? Well, for one thing, rest isn’t a magical spell that needs to do its work uninterrupted. If you work out an hour a day, you're still "resting" the other 23 hours. (You don’t even need full rest days if your workload is managed appropriately, but that’s a whole ’nother conversation.)

But ultimately, the big lesson every experienced gymgoer wishes they could impart to every noob is that getting most things right, most of the time, beats the pants off of occasionally getting everything to line up perfectly. If you only lift when you’ve had a good night’s sleep, you may not end up training as much as you’d like.

You don't need any particular product or gadget to achieve that, but wearables like smart rings and watches can help you keep tabs on how much sleep you're actually getting and whether you've been consistent about exercise. On the pricier end, there's the Oura ring, which is comfortable to wear to bed and will let you know how well you've been sleeping. If you're on a budget, something like the $99 Fitbit Air can do the job as well. Just remember that if a device gives you a poor score for your sleep or recovery, it doesn't mean you should automatically skip the gym. Prioritize consistency—including making it to the gym whenever you can—and you’re in a much better place to realize those gains.

https://lifehacker.com/health/should-you-still-work-out-if-sleep-deprived?utm_medium=RSS

Posted by Beth Skwarecki

https://lifehacker.com/entertainment/how-to-play-beeswax?utm_medium=RSS

I love a short daily word game, but Wordle isn't always enough to scratch that itch. I've had my share of fun with other letter-based guessing games and my new love Minute Cryptic, and I recently discovered Beeswax, a game that gives you five words to spell each day. It's like the spelling bees kids do: You listen to somebody say the word, and then you have to spell it correctly. One mistake, and you're out for the day.

How to play Beeswax

Note that Beeswax has nothing to do with the game Spelling Bee, a New York Times game that is bee-themed but involves manipulating written letters. Beeswax replicates the format of an actual in-person spelling bee. You click a button to hear the word (or to replay it if needed). If you're stuck, you can use hints.

The hints don't impact whether you win or lose, but the shareable text you get at the end will make a note of how many hints you used. The hints are, as in a spelling bee, all spoken as well. You can ask for a definition, a sentence using the word, the word's part of speech, or (my favorite when I'm stuck) the word's language of origin.

If you misspell a word, the game is over. The correct spelling is available on the "game over" screen, but it's hidden like spoiler text, in case you want to ponder your mistakes before revealing the answer. I've played several games, and so far I've missed two words: one that I thought I knew but must have been misspelling all this time, and one that was a new word to me. I can't say I'm disappointed: I've learned a new word.

How to win Beeswax

This is where I'd normally share some hints and tips, but the truth is: You just have to know how to spell the word, or be able to plausibly guess. The tips that apply to spelling bees in general are good ones here. The best tip is just to read more, so you get used to seeing more words. It's also helpful to become a nerd about etymology, constantly looking up words to see where they come from and why they're like that. (You'll start to recognize roots, prefixes, suffixes, and get a sense of how words of different language origins tend to be spelled.) This is more of a lifelong hobby than a strategy for a game, so, uh, good luck.

Personally, I find the language of origin the most helpful type of hint, but I've only played a handful of games so far (and never actually got to compete in a spelling bee as a child), so I can't promise that will always be the most helpful. The 12-year-old winner of the 2017 National Spelling Bee shared some tips with Lifehacker after her win, and she also recommended paying attention to word origins, so perhaps it's a good strategy after all.

Each word comes with a two-minute timer, so you can't think about it forever. That's plenty of time to simply look up the word yourself, of course. And paradoxically, that's what makes the game cheat-proof: After all, "go look up this word" isn't a fun game, and so there's no temptation to cheat. You also don't have to worry about running out of play time: Beeswax makes its entire archive available, even if you don't have an account. Free accounts give you the ability to keep a streak and to show up on the leaderboard.

https://lifehacker.com/entertainment/how-to-play-beeswax?utm_medium=RSS

Posted by Naima Karp

https://lifehacker.com/tech/gopro-360-max2-camera-sale-july-2026?utm_medium=RSS

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

360-degree cameras like the GoPro Max2 are designed for creators who want to capture more than what a single-lens camera, like the GoPro Hero series, can handle. Right now, the GoPro Max2 action camera is down from $499 to $299 on Amazon, the $200 discount marking its lowest price ever. 

GoPro Max2 Action Camera

$299.00 at Amazon

$499.00 Save $200.00

Get Deal

Get Deal

$299.00 at Amazon

$499.00 Save $200.00

Compared to the Max1, the Max2 has a higher 8K resolution and 29MP stills, resulting in sharper, more detailed footage and photos, while 10-bit color, GP-Log, and up to 14FPS Raw capture with 3D Tracking focus make it appealing for pros or anyone who wants more flexibility in post-production. It shoots 360-degree spherical video, unlike the single-lens action cams like the Hero, earning it an Editors' Choice Award from PCMag. This lets you record everything in your vicinity and reframe at any level, allowing for even more creative possibilities when editing.

With a magnesium chassis and weather protection, it's built for adventures and high-impact environments, with waterproofing up to 5 meters, a compact build, easy-to-replace lenses, and a variety of mounting options. As part of the GoPro ecosystem, it works seamlessly with the GoPro Quik video editing app for edits and reframing, while Bluetooth mic support and voice control make it even more versatile. 

Still, compared to the Hero series and its sensor design, low-light performance may be weaker, and battery life varies depending on whether you’re shooting with both lenses, the resolution, and the frame rate. Long 8K sessions will be more demanding, during which heat buildup can also happen. Slow motion also maxes out at 100 fps, and editing isn’t as slick or built for social shares as platforms like Insta360. 

If your priority is immersive storytelling, post-shoot reframing, and more creative freedom, the GoPro Max2 action camera is a strong choice for pros and casual users at $200 off, and a major upgrade over the original. But if you mainly want traditional action footage, often shoot in low-light conditions, and want longer battery life, the less-niche Hero line may suffice. 

https://lifehacker.com/tech/gopro-360-max2-camera-sale-july-2026?utm_medium=RSS

Posted by Pranay Parab

https://lifehacker.com/tech/best-new-messages-features-ios-27?utm_medium=RSS

We may earn a commission from links on this page.

While iOS 27 might be focused on Siri AI, there are plenty of other upgrades under the surface. Case in point: The new update brings a number of new features to Messages. The app is getting an AI feature that's actually useful, better notifications, and performance updates that bring faster loading and syncing across devices. Here's everything that's coming to Messages in iOS 27. Note that the update isn't due out until sometime in the fall, and while you can try these features on the iOS 27 beta now, understand the risks involved before you do. See Lifehacker's explainer here for more information.

iPhone 17 Pro

$1,099.00 at Apple

Shop Now

Shop Now

$1,099.00 at Apple

iPhone 17

$799.00 at Apple

Shop Now

Shop Now

$799.00 at Apple

iPhone 17e

$599.00 at Apple

Shop Now

Shop Now

$599.00 at Apple

Posted by Pradershika Sharma

https://lifehacker.com/tech/samsung-180hz-odyssey-g5-gaming-monitor-sale-july-2026?utm_medium=RSS

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Samsung’s 27-inch Odyssey G5 (G51F) gaming monitor has dropped to $149.99 on Amazon, which is the lowest price it has reached so far, according to price trackers. That’s a noticeable discount from its usual $249.99 price, and it makes a lot more sense now for anyone ready to move on from a basic 1080p setup without jumping into the much higher cost of OLED displays. It’s a flat panel (unlike Samsung’s many curved gaming displays), with a matte coating that helps minimize glare in brighter rooms, and comes with a stand that supports height, tilt, and pivot adjustments (something many budget gaming monitors skip entirely).

Samsung 27" Odyssey G5 (G51F) Gaming Monitor

$149.99 at Amazon

$249.99 Save $100.00

Get Deal

Get Deal

$149.99 at Amazon

$249.99 Save $100.00

The G51F’s combination of 180Hz refresh rate, 1ms response time, and AMD FreeSync support makes fast-paced games look smoother and feel more responsive than they do on standard 60Hz displays, especially in shooters, racing games, and competitive multiplayer titles. The VA panel also helps the monitor deliver deeper blacks and stronger contrast than many IPS alternatives in this price range, so darker games and movies tend to look less gray and washed out. That said, while HDR10 support is included, buyers should keep expectations realistic—with 300 nits of brightness, this is more of a basic HDR experience than the kind of dramatic HDR you get from higher-end Mini LED or OLED displays.

Outside of gaming, the Odyssey G5 works reasonably well as a general-purpose monitor too. The sharper 1440p resolution makes multitasking easier, and the extra screen space helps when editing photos, managing spreadsheets, or keeping multiple windows open. Connectivity is decent as well, with HDMI, DisplayPort, and USB support for accessories and peripherals. That said, like many VA panels, it can show some motion smearing in darker scenes, and people who mainly play competitive esports games may still prefer faster IPS or OLED options. Still, for under $160, this makes for a practical upgrade for someone who wants sharper visuals, smoother gameplay, and a more versatile display without overspending.

https://lifehacker.com/tech/samsung-180hz-odyssey-g5-gaming-monitor-sale-july-2026?utm_medium=RSS